Oracle Forms Services Unauthorized Form Execution Vulnerability

Bugtraq ID:	14319
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 19 2005 12:00AM
Updated:	Jul 19 2005 12:00AM
Credit:	Alexander Kornbrust <[email protected]> discovered this vulnerability.
Vulnerable:	Oracle Forms And Reports 6.0.8 .25 Oracle Forms And Reports 5.0 Oracle Forms And Reports 4.5.10 .22 Oracle Forms And Reports 9i Oracle Forms And Reports 6i Oracle Forms And Reports 10g
Not Vulnerable:

Oracle Forms Services Unauthorized Form Execution Vulnerability

Oracle Forms Services is susceptible to an unauthorized form execution vulnerability.

Attackers may exploit this vulnerability to execute arbitrary commands with the privileges of the Oracle account under which the server is executing.

It should be noted that this issue may be remotely exploited if an attacker has means to write files to the serving computer (WebDAV, FTP, CIFS, etc.) without local access.

Oracle Forms Services Unauthorized Form Execution Vulnerability

An exploit is not required.

Example URIs sufficient to exploit this vulnerability was provided:
http://www.example.com:7779/forms90/f90servlet?form=/public/johndoe/hacker.fmx
http://www.example.com:7779/forms90/f90servlet?module=/tmp/hacker.fmx

Oracle Forms Services Unauthorized Form Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Oracle Forms Services Unauthorized Form Execution Vulnerability

References:

• Oracle Homepage (Oracle)
  
• Run any OS Command via unauthorized Oracle Forms (Red-Database-Security GmbH)
  
• Oracle Security Advisory: Run any OS Command via unauthorized Oracle Forms ([email protected])